An authenticated user who has cursor termination privileges on a single database can exploit a missing scoping check to terminate cursors that belong to a different database. This illegal termination disrupts ongoing queries for other users, effectively denying access to legitimate database operations. The weakness comes from an improper authorization check that does not correctly scope privileges to the specific namespace, allowing cross‑database privilege misuse.

MongoDB Server instances are affected. The vulnerability is present in versions of MongoDB Server that have not yet applied the fix; specific version ranges are not disclosed, so all deployed installations should be evaluated for the presence of the flaw.

The CVSS score is 2.3, indicating a low severity. The EPSS score is less than 1%, indicating a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attack requires valid credentials with cursor termination rights, making it a credential‑based vulnerability. Based on the information, it is inferred that no public exploits or widespread targeting have been reported, as the description does not mention any exploits. The risk for most environments remains low, though the potential for denial of service exists if an attacker gains the affected privileges.